What is the CVSS score of CVE-2026-45593?

CVE-2026-45593 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows SDK are affected by CVE-2026-45593?

Microsoft Windows SDK contains a local privilege escalation vulnerability (CVE-2026-45593) that allows authenticated low-privilege users to gain full system access through memory corruption.. A patch is available.

How to fix or mitigate CVE-2026-45593?

Within 24 hours: Identify and inventory all systems running Microsoft Windows SDK; determine which have low-privileged user populations. Within 7 days: Restrict SDK access to necessary personnel, implement least-privilege principles for SDK processes, and deploy endpoint detection and response (EDR) monitoring for privilege escalation attempts. Within 30 days: Establish a Windows SDK patching protocol; monitor Microsoft advisories for patch availability or consider migration to patched SDK versions if released.

Windows SDK CVE-2026-45593

EUVD-2026-35551 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-06-09 secure@microsoft.com

GHSA-7wcr-pr25-7v9h

Denial Of Service Microsoft Integer Overflow

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:14 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionNVD

Use after free in Windows SDK allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows SDK enables an authenticated low-privileged attacker to elevate to higher privileges by exploiting a use-after-free memory corruption flaw. The CVSS 7.8 (AV:L/AC:L/PR:L) profile reflects local attack with low complexity and low privileges required, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The flaw resides in the Microsoft Windows SDK, the developer toolkit that ships headers, libraries, and runtime components used to build Windows applications. Although the CWE is tagged as CWE-190 (Integer Overflow), the description identifies a use-after-free condition, suggesting an integer overflow that miscomputes an allocation size or reference count and leads to premature freeing of an object that is later dereferenced. Exploiting such a dangling pointer typically yields control over a freed heap chunk, allowing an attacker to corrupt adjacent structures or hijack object virtual tables to achieve code execution in the context of a higher-privileged process linked against the SDK runtime.

RemediationAI

Patch availability per vendor advisory should be confirmed by reviewing the Microsoft Security Response Center entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45593 and applying the fixed Windows SDK release once Microsoft publishes the exact build numbers; the input data does not include a specific patched version. As compensating controls until patches are deployed, restrict local interactive and RDP access on developer workstations and build agents to trusted users, enforce least-privilege on accounts that run SDK tooling, and monitor for unexpected child processes or token manipulation by SDK-linked binaries - note that tightening local access can disrupt developer productivity and CI pipelines, so coordinate with engineering teams. Application allowlisting (e.g., Windows Defender Application Control) can further reduce the risk of arbitrary local binaries triggering the vulnerable code path at the cost of additional rule maintenance.